CN112801453B - A risk assessment method, device, terminal and storage medium - Google Patents

Abstract

The application is suitable for the field of computers and provides a risk assessment method, a risk assessment device, a risk assessment terminal and a risk assessment storage medium. The risk assessment method comprises the following steps: acquiring a risk item of each resource item of an industrial control system, a resource importance degree value of each resource item, and a loss degree value of each risk item of each resource item, which causes resource loss to the resource item; collecting resource information of each resource item, and determining the occurrence frequency of each risk item in each resource item according to the resource information; and determining the risk value of each risk item in each resource item according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item and the loss degree value of each risk item of each resource item, which causes resource loss to the resource item. The embodiment of the application can perform risk assessment on resources of the industrial control system, realize early warning on risk items existing in the industrial control system, and is beneficial to enterprises to avoid risks.

Description

A risk assessment method, device, terminal and storage medium

Technical Field

The present invention relates to the field of computers, and more particularly to a risk assessment method, device, terminal and storage medium.

Background Art

Industrial Control Systems (ICS), also known as industrial control systems, are business process management and control systems that are composed of various automation control components and process control components that collect and monitor real-time data to ensure the automated operation, process control and monitoring of industrial infrastructure.

The widespread use of general network technologies in industrial control systems has increased the openness of industrial control systems and made them more closely connected with the public Internet. However, the use of general network technologies also brings some risks, which can easily cause the loss of resources in industrial control systems.

Therefore, there is a need for a method to conduct risk assessment on the resources of industrial control systems to help enterprises to issue early warnings on risk items in industrial control systems and reduce resource losses that occur when enterprises use industrial control systems.

Summary of the invention

The embodiments of the present application provide a risk assessment method, device, terminal and storage medium, which can perform risk assessment on the resources of industrial control systems and provide early warning for risk items existing in the industrial control systems, which is helpful for enterprises to avoid risks.

A first aspect of an embodiment of the present application provides a risk assessment method, comprising:

Obtaining the risk item of each resource item of the industrial control system and the resource importance value of each resource item, as well as the loss degree value of the resource loss caused by each risk item of each resource item to the resource item;

Collecting resource information of each of the resource items, and determining the occurrence frequency of each of the risk items in each of the resource items according to the resource information;

The risk value of each risk item in each resource item is determined according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item and the loss degree value of each risk item of each resource item causing resource loss to the resource item.

A second aspect of an embodiment of the present application provides a testing device, comprising:

an acquisition unit, configured to acquire a risk item of each resource item of the industrial control system and a resource importance value of each resource item, and a loss degree value of resource loss caused by each risk item of each resource item to the resource item;

a collecting unit, configured to collect resource information of each of the resource items, and determine the occurrence frequency of each of the risk items in each of the resource items according to the resource information;

A determination unit is used to determine the risk value of each risk item in each of the resource items according to the resource importance value of each of the resource items, the occurrence frequency of each risk item of each of the resource items, and the loss degree value of the resource loss caused by each risk item of each of the resource items to the resource item.

A third aspect of an embodiment of the present application provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

A fifth aspect of an embodiment of the present application provides a computer program product, which, when the computer program product runs on a terminal, enables the terminal to implement the steps of the method when executing the computer program product.

It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

In the embodiment of the present application, the risk item of each resource item of the industrial control system and the resource importance value of each resource item, as well as the loss degree value of each risk item of each resource item causing resource loss to the resource item, are obtained. Then, the resource information of each resource item is collected, and the occurrence frequency of each risk item in each resource item is determined according to the resource information. Next, the risk value of each resource item is determined according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item. The risk value of the industrial control system can be determined by the collected resource information, and the risk assessment of the industrial control system can be realized, and the risk items existing in the industrial control system can be warned, which is conducive to risk avoidance for enterprises.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

FIG1 is a schematic diagram of an implementation flow of a risk assessment method provided in an embodiment of the present application;

FIG2 is a schematic diagram of a specific implementation process for determining the occurrence frequency of each risk item provided in an embodiment of the present application;

FIG3 is a schematic diagram of the structure of a risk assessment device provided in an embodiment of the present application;

FIG4 is a schematic diagram of the structure of a terminal provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. Based on the embodiments of the present application, all other embodiments obtained by technical personnel in this field without making creative work are within the scope of protection of the present application.

Industrial Control Systems (ICS), also known as industrial control systems, are business process management and control systems that are composed of various automation control components and process control components that collect and monitor real-time data to ensure the automated operation, process control and monitoring of industrial infrastructure.

At present, the overall scale of industrial control systems is gradually expanding, and the frequency of application of information and network technologies in ICS is increasing. For example, the use of operating systems and TCP/IP protocols can realize the monitoring and control of industrial control networks from the control layer to the management layer.

The widespread use of general network technologies in industrial control systems has increased the openness of industrial control systems and made the connection between industrial control systems and the public Internet closer. However, the use of general network technologies also brings some risks, which break the closedness of industrial control networks and the Internet, expose the vulnerability of industrial control systems to the public network, increase the probability of important resources being threatened, and the combination of resource value and resource vulnerability will increase the loss of resources in industrial control systems caused by security incidents.

Therefore, considering the above-mentioned problems, a method for risk assessment of industrial control systems is needed to assist enterprises in determining the value of resources, assessing the threats and vulnerabilities faced by resources, and promptly identifying problems in industrial control systems, providing support for enterprises to take security measures as early as possible and reduce the risks of industrial control systems.

In order to illustrate the technical solution of the present application, a specific embodiment is provided below for illustration.

FIG1 shows a schematic diagram of an implementation flow of a risk assessment method provided in an embodiment of the present application. The method can be applied to a terminal and is applicable to situations where risk assessment of resources of an industrial control system is required.

Among them, the above-mentioned terminal can be a management terminal in an industrial control system, such as a management server, a computer, etc.

Specifically, the above risk assessment method may include the following steps S101 to S103.

Step S101, obtaining the risk items of each resource item of the industrial control system and the resource importance value of each resource item, as well as the loss degree value of each risk item of each resource item causing resource loss to the resource item.

The above resource items may be assets or other types of resource items involved in the industrial control system.

In actual applications, different industrial control systems may have different resource items according to their actual conditions, and the importance of the same resource item in different industrial control systems may also be different. Therefore, in some implementations of the present application, the above terminal needs to determine each resource item of the industrial control system and classify the resource items.

The above classification methods can be selected by experienced technicians in the field according to actual conditions. For example, the specific resource item classification method can be classified according to specific evaluation objects and requirements. Taking the above resource items as assets as an example, the above assets refer to information or resources that are valuable to the organization and are the objects protected by security policies. The pre-classified categories can include software systems, network devices, and security devices, etc. The assets included in the software system can include operating systems and database management systems, etc.

Generally, each resource item generally has a corresponding risk item, and the above risk item refers to a threat that affects the resource item and causes resource loss in the resource item. In some implementations of the present application, after each resource item of the industrial control system is obtained, the risk item of each resource item can be determined.

In some embodiments of the present application, an administrator with experience in the field can predetermine the possible risk items for each resource item based on past experience or problems that arise during the actual operation of the industrial control system.

Taking the resource item as an asset as an example, if the asset is a software system, its risk items can be system software failure, malicious code or unauthorized operation, etc. If the asset is a security device or network device, its risk items can be hardware failure, network attack or physical attack, etc.

When a risk item appears in an industrial control system, that is, when the industrial control system is threatened, it will directly lead to resource loss. However, different risk items cause different resource losses to the industrial control system, and the same risk item causes different resource losses in different industrial control systems. Therefore, in order to accurately assess the risks caused by risk items in the current industrial control system, the above terminal also needs to obtain the resource importance value of each resource item and the proportion of resource loss caused by each risk item of each resource item to the resource item.

The resource importance value refers to the degree of achievement of the security attribute of the resource item or the degree of impact caused by the failure of the security attribute. Different degrees of achievement of the security attribute will make the resource item have different values. In some embodiments of the present application, an administrator with experience in the field can evaluate the resource item according to the confidentiality, integrity and availability of the resource item and assign a value according to the evaluation result to obtain the resource importance value.

Correspondingly, since the resource losses caused by each risk item of each resource item are also different, it is also necessary to determine the loss degree value of the resource loss caused by it. The loss degree value is the importance of the vulnerability of the resource item, which indicates the proportion of resource loss caused if the vulnerability of the resource item is exploited by the corresponding risk item.

In some embodiments of the present application, the loss degree value can be determined according to the following table.

Loss degree value definition 5 If exploited by risk items, it will cause complete damage to resources 4 If exploited by risk items, it will cause significant damage to resources 3 If exploited by a risk item, it will cause general damage to resources 2 If exploited by risk items, it will cause minor damage to resources 1 If exploited by risk items, the damage to resources can be ignored

It should be noted that if there are multiple vulnerabilities associated with a risk item, the risk item can have multiple loss degree values, and each loss degree value corresponds to a vulnerability.

Step S102: collecting resource information of each resource item, and determining the occurrence frequency of each risk item in each resource item according to the resource information.

The resource information mentioned above refers to the relevant information of the resource items of the industrial control system.

In the implementation manner of the present application, for different resource items, the collection methods used may be different, and the resource information obtained according to different collection methods may also be expressed in different forms. For example, the above resource information may be information such as the work log of the equipment in the industrial control system, the work protocol or file of the industrial control system, etc.

In some implementations of the present application, the resource items include operator stations; in this case, the collection of resource information of each resource item may include: obtaining log information of the operator station; and using the log information as resource information.

Specifically, for devices with common operating systems such as Windows XP, WIndows7, and Windows Server 2000 in industrial control system operator stations, log information can be collected by installing a collector. The above log information may include the host operating system production and operation status, fault information, user operation behavior, system configuration, operating system vulnerabilities and patches, network connections, network services, network communications, security protection status and other related information.

In some other embodiments of the present application, the above-mentioned resource items may include network devices and security devices. In this case, the above-mentioned collection of resource information of each of the resource items may include: receiving notification messages sent by a first network node associated with the network device and a second network node associated with the security device through a simple network management protocol (SNMP); and using the notification information as resource information.

Specifically, for a large number of network devices such as switches and routers, or security devices such as firewalls, in the industrial control network system, the terminal can send a request to the first network node and the second network node through the simple network management protocol, and the request is used to inquire about the parameter values of the pre-defined related information. After receiving the request, the first network node and the second network node will feedback a notification information to the terminal, and the notification information carries the parameter value. According to the pre-defined definition of each parameter value, the terminal can detect whether the related information is a risk item.

In other embodiments of the present application, the above-mentioned terminal can obtain imported resource information. For example, for other types of data such as industrial control private protocols, files, Nginx logs, MySQL logs, etc., data can be collected by importing logs.

It should be noted that, in some embodiments of the present application, the terminal may establish a management database and store the resource information collected in the management database. The management database may also be used to store original alarm information, processed alarm information, alarm association rules, risk assessment and other information. Risk assessment based on the management database can improve the efficiency of risk assessment and facilitate users to query and manage various data.

In an implementation manner of the present application, after collecting resource information of each resource item, the above-mentioned terminal can determine the occurrence frequency of each risk item in each resource item according to the resource information.

Specifically, after collecting the resource information of each resource item, the terminal can compare the resource information with the resource template information in the preset risk project target, determine each risk item therein, and count the occurrence frequency of each risk item therein.

Taking resource information as a work log as an example, each record in the work log can be compared with the corresponding template in the resource template information. If the record is different from the template, it means that the record corresponds to a risk item. After all risk items are determined from the entire work log, the frequency of occurrence of each risk item can be counted.

It should be noted that in some embodiments of the present application, the above-mentioned terminal can assign a value to the occurrence frequency according to the following table, and use the obtained occurrence frequency value to calculate the subsequent risk value.

Step S103, determining the risk value of each risk item in each resource item according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item.

Among them, the above risk value refers to the severity of resource loss caused by the risk item.

In the implementation of the present application, the above risk value is related to the possibility of a security incident and the resource loss caused by the security incident, that is, the higher the possibility of a security incident, the higher the risk value, and at the same time, the more resource losses caused by the security incident, the higher the risk value. The possibility of a security incident is related to the occurrence frequency of each risk item of each resource item and the loss degree value of each risk item of each resource item causing resource loss to the resource item, and the resource loss caused by the security incident is related to the resource importance value of each resource item and the loss degree value of each risk item of each resource item causing resource loss to the resource item.

Therefore, according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item, the above terminal can determine the risk value of each risk item in each resource item.

It should be noted that experienced technicians in this field can pre-divide multiple risk value intervals, and each interval corresponds to a risk value level, and each risk value level corresponds to a different risk severity. At this time, based on the interval where the risk value is located, the above-mentioned terminal can determine the risk value level corresponding to the risk item, so that the user can determine the current risk severity based on the risk value level.

For example, the following table shows a correspondence between different risk value levels and risk severity.

In the embodiment of the present application, the risk item of each resource item of the industrial control system and the resource importance value of each resource item, as well as the loss degree value of each risk item of each resource item causing resource loss to the resource item, are obtained. Then, the resource information of each resource item is collected, and the occurrence frequency of each risk item in each resource item is determined according to the resource information. Then, the risk value of each resource item is determined according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item. The risk value of the industrial control system can be determined by the collected resource information, and the risk assessment of the industrial control system can be realized, and the risk items existing in the industrial control system can be warned, which is conducive to the enterprise to avoid risks.

Specifically, the calculation method of the above risk value can be selected according to actual conditions.

In some embodiments of the present application, in the above step of determining the risk value of each risk item in each resource item according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item, the step of determining the risk value of a single risk item includes: determining the risk value of each risk item according to the risk estimation formula Determine the risk value of the risk item.

Wherein, la is the resource importance value of the resource item associated with the risk item, T is the occurrence frequency of the risk item, and V is the loss degree value of the resource loss caused by the risk item to the resource item associated with the risk item.

Specifically, in the above risk estimation formula, T×V can be used to represent the possibility of a security incident, and la×V can be used to represent the resource loss caused by the security incident. Based on the multiplication operation between the possibility of a security incident and the resource loss caused by the security incident, when the possibility of a security incident is high or the resource loss caused by the security incident is high, the risk value corresponding to the risk item is also high.

In the implementation mode of the present application, according to the risk estimation formula To determine the risk value of the resource item, the risk value can be calculated based on two factors: the possibility of a security incident occurring and the resource loss caused by the security incident, so that the calculated risk value is more accurate, that is, more in line with the severity of the resource loss caused when the risk actually occurs.

In actual applications, the resource information of each resource item collected by the above-mentioned terminal may ignore some problems encountered by the industrial control system in actual operation. Therefore, in order to make the risk value assessment result more accurate, in other embodiments of the present application, the above-mentioned risk assessment method may also include: obtaining user survey results of the industrial control system.

Among them, the above-mentioned user survey results refer to the results determined after statistics are collected on the information filled in by users in the questionnaire.

Specifically, the questionnaire may include threats to assets, including software and hardware failures, physical environment impacts, inaction or operational errors, inadequate management, malicious code, unauthorized access or abuse, network attacks, physical attacks, leaks, tampering, denial, etc. In addition, the questionnaire may include a vulnerability identification table, including physical environment, network structure, system software, application middleware, application system, technical management and organizational management. Users fill in the questionnaire, and the information filled in by users is counted to obtain the user survey results.

At this time, as shown in Figure 2, in some implementations of the present application, the above-mentioned determination of the occurrence frequency of each risk item in each resource item based on resource information may include the following steps S201 to S202.

Step S201, obtaining a preset risk item template.

Among them, the above-mentioned risk item template records resource template information and investigation result template information. The resource template information refers to the standard result corresponding to each resource information, and the investigation result template information refers to the standard result corresponding to each investigation result.

Step S202, compare the resource information and the user survey results with the corresponding resource template information and survey result template information in the preset risk item template, determine the risk items appearing in the user survey results and the resource information, and count the occurrence frequency of the risk items.

Specifically, each resource information of the resource information can be compared with the resource template information corresponding to the resource information. If there is a difference between the resource information and the resource template information corresponding to the resource information, that is, the actually collected information is different from the standard result, it means that a risk item appears in the resource information, and the resource information corresponds to a risk item. Similarly, each survey result of the user survey result can be compared with the survey result template information corresponding to the survey result. If there is a difference between the survey result and the survey result template information corresponding to the survey result, that is, the actually obtained survey result is different from the standard result, it means that a risk item appears in the survey result, and the survey result corresponds to a risk item.

For example, the question in the questionnaire is "Is port 445 enabled?" The result of this item in the user survey result is "Yes", while the corresponding result of this item in the survey result template information is "No". If so, it means that a risk item has occurred, and the risk item is the incorrect startup of port 445.

In the implementation mode of the present application, the risk items appearing in the user survey results and resource information can be determined based on the above method, and then the frequency of occurrence of the risk items can be statistically calculated based on the risk items that appear.

In the implementation mode of the present application, by obtaining a preset risk item template, and comparing the resource information and the user survey results with the corresponding resource template information and survey result template information in the preset risk item template, the risk items appearing in the user survey results and the resource information are determined, and the frequency of occurrence of the risk items is counted. The risk can be evaluated based on the resource information collected by the industrial control system itself and the user survey results from the users of the industrial control system, so that the evaluation process can take into account some problems encountered by the industrial control system in actual operation, and obtain more accurate risk value evaluation results.

It should be noted that after determining each risk item in the survey results and resource information, it also includes: aggregating the risk items appearing in the survey results and resource information, and outputting risk warning information based on the aggregated risk items.

In an embodiment of the present application, the same risk item may appear multiple times. By aggregating the risk items, it is possible to avoid the accumulation of duplicate alarm information, which would lead to an excessive number of alarms to be processed.

The risk warning information may include information such as alarm resource items, risk items, time, and log details associated with the risk items, including changes in the number of target objects, whether target object events occur, whether target object index items are in a predetermined list, and whether target object indexes exceed a specified threshold. In addition, the terminal may export the risk warning information in CSV format.

Furthermore, the above risk warning information can be sorted according to the time of occurrence, and the earlier the time, the higher the sorting.

The embodiments of the present application take into account the time factor while aggregating, avoiding the presence of a lot of redundant information in the output risk warning information, and facilitating users to view and manage risk items.

In some embodiments of the present application, after determining the risk value of each risk item in each resource item, it also includes: displaying each resource item of the industrial control system, the resource information of each resource item, each risk item of each resource item, and the risk value of each risk item.

That is to say, in some embodiments of the present application, the above-mentioned terminal can perform resource profiling of the industrial control system to visualize the resources and facilitate user viewing.

Specifically, a comprehensive knowledge base can be established for the basic attributes, operation information, log information, and abnormal information of resources. And the information can be displayed on the page so that users can intuitively understand the historical or current status information of the asset. The page can display each resource item of the industrial control system, the resource information of each resource item, each risk item of each resource item, and the risk value of each risk item, such as whether the system concerned by the Windows host is online, healthy, whether the load is reasonable, whether the enabled network service is compliant and normal, whether there is interconnection between assets allowed by the rules, whether there are illegal users logging in, whether the system configuration is changed, whether important application software fails, whether there are system vulnerabilities, whether it is attacked maliciously, whether it is planted with Trojans, whether there are illegal peripherals that are not prohibited, whether there is installed protection software to help prevent the impact of malicious software, whether the device and application software have interrupted the network connection, etc.

Furthermore, the above-mentioned terminal can generate PDF statistical reports and PDF analysis reports based on various dimensional information of resources, namely, each resource item of the industrial control system, the resource information of each resource item, each risk item of each resource item, and the risk value of each risk item.

It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited to the described order of actions, because according to the present application, some steps can be performed in other orders.

FIG3 is a schematic diagram of the structure of a risk assessment device 300 provided in an embodiment of the present application, wherein the risk assessment device 300 is configured on a terminal. The risk assessment device 300 may include:

The acquisition unit 301 is used to acquire the risk item of each resource item of the industrial control system and the resource importance value of each resource item, and the loss degree value of the resource loss caused by each risk item of each resource item to the resource item;

A collection unit 302, configured to collect resource information of each of the resource items, and determine the occurrence frequency of each of the risk items in each of the resource items according to the resource information;

The determination unit 303 is used to determine the risk value of each risk item in each of the resource items according to the resource importance value of each of the resource items, the occurrence frequency of each risk item of each of the resource items, and the loss degree value of the resource loss caused by each risk item of each of the resource items to the resource item.

In some implementations of the present application, the determination unit 303 may also be used to: for a single risk item, according to the risk estimation formula Determine the risk value of the risk item; wherein la is the resource importance value of the resource item associated with the risk item, T is the occurrence frequency of the risk item; and V is the loss degree value of the resource loss caused by the risk item to the resource item associated with the risk item.

In some embodiments of the present application, the acquisition unit 301 may also be used to: acquire user survey results of the industrial control system; the acquisition unit 302 may also be used to: acquire a preset risk item template; compare the resource information and the user survey results with the corresponding resource template information and survey result template information in the preset risk item template, respectively, to determine the risk items appearing in the user survey results and the resource information, and to count the frequency of occurrence of the risk items.

In some embodiments of the present application, the risk assessment device 300 further includes a prompt unit, which can be used to aggregate the risk items appearing in the user survey results and the resource information, and output risk prompt information based on the aggregated risk items.

In some embodiments of the present application, the above-mentioned risk assessment device 300 also includes a display unit, which can be used to: display each resource item of the industrial control system, the resource information of each resource item, the various risk items of each resource item, and the risk value of each risk item.

In some implementations of the present application, the resource item includes an operator station; the acquisition unit 302 may also be used to: obtain log information of the operator station; and use the log information as the resource information.

In some implementations of the present application, the above-mentioned resource items include network devices and security devices; the above-mentioned collection unit 302 can also be used to: receive notification messages sent by a first network node associated with the network device and a second network node associated with the security device through a simple network management protocol; and use the notification information as the resource information.

It should be noted that, for the convenience and simplicity of description, the specific working process of the above-mentioned risk assessment device 300 can refer to the corresponding process of the method described in Figures 1 to 2, and will not be repeated here.

As shown in FIG4 , it is a schematic diagram of a terminal provided in an embodiment of the present application. The terminal 4 may include: a processor 40, a memory 41, and a computer program 42 stored in the memory 41 and executable on the processor 40, such as a test program. When the processor 40 executes the computer program 42, the steps in the above-mentioned various risk assessment method embodiments are implemented, such as steps S101 to S103 shown in FIG1 . Alternatively, when the processor 40 executes the computer program 42, the functions of each module/unit in the above-mentioned various device embodiments are implemented, such as the functions of the acquisition unit, the collection unit, and the determination unit shown in FIG3 .

The computer program may be divided into one or more modules/units, which are stored in the memory 41 and executed by the processor 40 to complete the present application. The one or more modules/units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the terminal.

For example, the computer program may be divided into: an acquisition unit, a collection unit and a determination unit. The specific functions of each unit are as follows:

an acquisition unit, configured to acquire a risk item of each resource item of the industrial control system and a resource importance value of each resource item, and a loss degree value of resource loss caused by each risk item of each resource item to the resource item;

a collecting unit, configured to collect resource information of each of the resource items, and determine the occurrence frequency of each of the risk items in each of the resource items according to the resource information;

A determination unit is used to determine the risk value of each risk item in each of the resource items according to the resource importance value of each of the resource items, the occurrence frequency of each risk item of each of the resource items, and the loss degree value of the resource loss caused by each risk item of each of the resource items to the resource item.

The terminal may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will appreciate that FIG4 is merely an example of a terminal and does not limit the terminal, and may include more or fewer components than shown in the figure, or may combine certain components, or different components. For example, the terminal may also include input and output devices, network access devices, buses, etc.

The processor 40 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

The memory 41 may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal. The memory 41 may also be an external storage device of the terminal, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal. Further, the memory 41 may also include both an internal storage unit of the terminal and an external storage device. The memory 41 is used to store the computer program and other programs and data required by the terminal. The memory 41 may also be used to temporarily store data that has been output or is to be output.

It is clear to the technicians in the relevant field that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

In the embodiments provided in the present application, it should be understood that the disclosed devices/terminals and methods can be implemented in other ways. For example, the device/terminal embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional unit.

If the integrated module/unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practices in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practices, computer-readable media do not include electrical carrier signals and telecommunication signals.

The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above-described embodiments, a person skilled in the art should understand that the technical solutions described in the above-described embodiments can still be modified, or some of the technical features can be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims (9)

1. A risk assessment method, comprising: Acquire the risk item of each resource item of the industrial control system and the resource importance value of each resource item, as well as the loss degree value of the resource loss caused by each risk item of each resource item to the resource item; Collecting resource information of each of the resource items, and determining the occurrence frequency of each of the risk items in each of the resource items according to the resource information, wherein the resource information is collected by the industrial control system; Determine the risk value of each risk item in each resource item according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of each risk item of each resource item causing resource loss to the resource item; The risk assessment method further includes: obtaining user survey results of the industrial control system; The method of determining the occurrence frequency of each risk item in each resource item based on the resource information includes: obtaining a preset risk item template; comparing the resource information and the user survey results with the corresponding resource template information and survey result template information in the preset risk item template, respectively; if there is a difference between the resource information and the resource template information, confirming the risk items appearing in the resource information; if there is a difference between the survey result and the survey result template information, confirming the risk items appearing in the user survey result, and counting the occurrence frequency of the risk items. 2. The risk assessment method according to claim 1 is characterized in that, in the step of determining the risk value of each risk item in each of the resource items according to the resource importance value of each of the resource items, the occurrence frequency of each risk item of each of the resource items, and the loss degree value of the resource loss caused by each risk item of each of the resource items to the resource item, the step of determining the risk value of a single risk item comprises: According to the risk estimation formula Determine the risk value of the risk item; wherein la is the resource importance value of the resource item associated with the risk item, T is the occurrence frequency of the risk item; and V is the loss degree value of the resource loss caused by the risk item to the resource item associated with the risk item. 3. The risk assessment method according to claim 1, characterized in that after determining the risk items appearing in the user survey results and the resource information, it further comprises: The risk items appearing in the user survey result and the resource information are aggregated, and risk warning information is output according to the aggregated risk items. 4. The risk assessment method according to claim 1 or 2, characterized in that after determining the risk value of each risk item in each resource item, it also includes: Each resource item of the industrial control system, resource information of each resource item, various risk items of each resource item, and a risk value of each risk item are displayed. 5. The risk assessment method according to claim 1 or 2, characterized in that the resource item comprises an operator station; The collecting of resource information of each resource item includes: Obtaining log information of the operator station; The log information is used as the resource information. 6. The risk assessment method according to claim 1 or 2, characterized in that the resource items include network devices and security devices; The collecting of resource information of each resource item includes: Receiving, via a simple network management protocol, a notification message sent by a first network node associated with the network device and a second network node associated with the security device; The notification information is used as the resource information. 7. A risk assessment device, comprising: An acquisition unit, used to acquire a risk item of each resource item of the industrial control system and a resource importance value of each resource item, and a loss degree value of resource loss caused by each risk item of each resource item to the resource item; A collection unit, used to collect resource information of each of the resource items, and determine the occurrence frequency of each of the risk items in each of the resource items according to the resource information, wherein the resource information is collected by the industrial control system; A determination unit, configured to determine the risk value of each risk item in each resource item according to the resource importance value of each resource item, the occurrence frequency of each risk item of each resource item, and the loss degree value of resource loss caused by each risk item of each resource item to the resource item; The acquisition unit is further used to: acquire a user survey result of the industrial control system; The collection unit is used to: obtain a preset risk item template; compare the resource information and the user survey results with the corresponding resource template information and survey result template information in the preset risk item template respectively; if there is a difference between the resource information and the resource template information, confirm the risk item appearing in the resource information; if there is a difference between the survey result and the survey result template information, confirm the risk item appearing in the user survey result, and count the occurrence frequency of the risk item. 8. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 6 when executing the computer program. 9. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 6.